Re:It’s Always Sunny in Reykjavik or How I NSA-Proofed My Em...
by nickpsecurity on Monday December 21, 2015 @12:41PM
(#10772240)
The NSA used to certify systems as highly assured by exhaustively analyzing and pentesting them for years. Had to beat their pentesters to be approved. Then, they'd try to restrict their export. It was a whole system process that applied from bottom to top to minimize complexity, reduce leaks, and enforce security policies. Here's a description of a superset of that I used in private work:
So, let's just compare the author's email to that list. A strong TCB at OS/firmware/trusted-component level like with EROS, INTEGRITY-178B, or GenodeOS? Nope. Components or apps made in a manner to reduce complexity, be type/memory safe, use static analysis, analyzed for covert channels, and so on? Probably not given names I saw. Do the underlying projects use a subversion-resistant development process and SCM security that assumes a number of them are malicious w/ independent auditing? Virtually nobody does that despite Myers (1980) showing subversion the most powerful attack. Has the crypto and its implementation been tested by experts in that? Don't know. Has the overall system and configuration been pentested by TAO-grade hackers? No.
So, it's far from NSA-proof as the underlying properties necessary for NSA-proof operation don't exist here. They exist only in a handful of defense-oriented products with some traits existing in other security-focused projects (esp in academia). This, at best, will slow down nation state attackers who are probably uninterested in his system anyway. A good configuration and 0-day mitigation tech might make this build survive typical blackhats and snoops. A real, threat profile along with more reasonable goal.
Won't stop the NSA, though. You can put money on that. Assume it's true every time you hear it, too. You can't stop nation-state attackers until you know how (see framework) then apply that to every level and user/machine interfaces. Even then, it might work and might just be an obstacle. So, include monitoring & logging on top of it.
http://pastebin.com/y3PufJ0V
So, let's just compare the author's email to that list. A strong TCB at OS/firmware/trusted-component level like with EROS, INTEGRITY-178B, or GenodeOS? Nope. Components or apps made in a manner to reduce complexity, be type/memory safe, use static analysis, analyzed for covert channels, and so on? Probably not given names I saw. Do the underlying projects use a subversion-resistant development process and SCM security that assumes a number of them are malicious w/ independent auditing? Virtually nobody does that despite Myers (1980) showing subversion the most powerful attack. Has the crypto and its implementation been tested by experts in that? Don't know. Has the overall system and configuration been pentested by TAO-grade hackers? No.
So, it's far from NSA-proof as the underlying properties necessary for NSA-proof operation don't exist here. They exist only in a handful of defense-oriented products with some traits existing in other security-focused projects (esp in academia). This, at best, will slow down nation state attackers who are probably uninterested in his system anyway. A good configuration and 0-day mitigation tech might make this build survive typical blackhats and snoops. A real, threat profile along with more reasonable goal.
Won't stop the NSA, though. You can put money on that. Assume it's true every time you hear it, too. You can't stop nation-state attackers until you know how (see framework) then apply that to every level and user/machine interfaces. Even then, it might work and might just be an obstacle. So, include monitoring & logging on top of it.